rust-ci.yml

# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: CI

on:
  push:
    branches: [ main ]
  pull_request:
  schedule:
    # Weekly security audit on Saturday at 00:30 UTC
    - cron: "30 0 * * 6"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  # CARGO_INCREMENTAL defaults to 1 (enabled) - better with rust-cache
  CARGO_NET_RETRY: 10
  RUSTUP_MAX_RETRIES: 10

jobs:
  # ============================================================
  # Version Consistency Check
  # Ensures all metadata files have matching versions
  # ============================================================
  verify-versions:
    name: Verify Versions
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Check version consistency
        run: |
          set -euo pipefail

          CARGO_VER=$(grep -A5 '^\[workspace\.package\]' Cargo.toml | grep '^version' | head -1 | sed 's/version = "\(.*\)"/\1/')
          CFF_VER=$(grep '^version:' CITATION.cff | sed "s/version: '\(.*\)'/\1/")
          ZENODO_VER=$(jq -r '.version' .zenodo.json)
          CODEMETA_VER=$(jq -r '.version' codemeta.json)

          echo "=== Version Check ==="
          echo "Cargo.toml:    $CARGO_VER"
          echo "CITATION.cff:  $CFF_VER"
          echo ".zenodo.json:  $ZENODO_VER"
          echo "codemeta.json: $CODEMETA_VER"
          echo ""

          MISMATCH=0
          [[ "$CARGO_VER" != "$CFF_VER" ]] && { echo "::error::CITATION.cff version mismatch"; MISMATCH=1; }
          [[ "$CARGO_VER" != "$ZENODO_VER" ]] && { echo "::error::.zenodo.json version mismatch"; MISMATCH=1; }
          [[ "$CARGO_VER" != "$CODEMETA_VER" ]] && { echo "::error::codemeta.json version mismatch"; MISMATCH=1; }

          if [[ $MISMATCH -eq 1 ]]; then
            echo ""
            echo "Fix: Run ./scripts/sync-version.sh"
            exit 1
          fi

          echo "All versions match: $CARGO_VER"

  # ============================================================
  # Format Check
  # Fast check that doesn't require dependencies or compilation
  # ============================================================
  format:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt

      - name: Check formatting
        run: cargo fmt --all --check

  # ============================================================
  # Clippy Linting (Cross-Platform) - Core Targets
  # One target per OS family - runs on all PRs and pushes
  # ============================================================
  clippy:
    name: Clippy (${{ matrix.target }})
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # Core targets: one native target per OS family
          - target: x86_64-unknown-linux-gnu
            runner: ubuntu-latest
            native: true
          - target: x86_64-pc-windows-msvc
            runner: windows-latest
            native: true
          - target: aarch64-apple-darwin
            runner: macos-latest
            native: true
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
          targets: ${{ matrix.target }}

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ci-clippy-${{ matrix.target }}
          cache-on-failure: true

      - name: Install system dependencies (Linux)
        if: runner.os == 'Linux'
        uses: awalsh128/cache-apt-pkgs-action@latest
        with:
          packages: libgtk-3-dev libxdo-dev
          version: 1.0

      - name: Run Clippy (Unix)
        if: runner.os != 'Windows'
        run: cargo clippy --target ${{ matrix.target }} --all-targets --all-features -- -D warnings

      - name: Run Clippy (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: cargo clippy --target ${{ matrix.target }} --all-targets --all-features -- -D warnings

  # ============================================================
  # Clippy Linting (Cross-Platform) - Extended Targets
  # Additional targets for full coverage - main branch only
  # ============================================================
  clippy-extended:
    name: Clippy Extended (${{ matrix.target }})
    if: github.ref == 'refs/heads/main'
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # Extended targets: ARM Linux, ARM Windows, Intel macOS
          - target: aarch64-unknown-linux-gnu
            runner: ubuntu-24.04-arm
            native: true
          - target: aarch64-pc-windows-msvc
            runner: windows-latest
            native: false
          - target: x86_64-apple-darwin
            runner: macos-latest
            native: false
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
          targets: ${{ matrix.target }}

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ci-clippy-${{ matrix.target }}
          cache-on-failure: true

      - name: Install system dependencies (Linux)
        if: runner.os == 'Linux'
        uses: awalsh128/cache-apt-pkgs-action@latest
        with:
          packages: libgtk-3-dev libxdo-dev
          version: 1.0

      - name: Run Clippy (Unix)
        if: runner.os != 'Windows'
        run: |
          if [ "${{ matrix.native }}" = "true" ]; then
            cargo clippy --target ${{ matrix.target }} --all-targets --all-features -- -D warnings
          else
            cargo clippy --target ${{ matrix.target }} --all-features -- -D warnings
          fi

      - name: Run Clippy (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: cargo clippy --target ${{ matrix.target }} --all-features -- -D warnings

  # ============================================================
  # Tests
  # Runs in parallel with clippy after format passes (fast gate)
  # Uses debug mode for PRs (faster), release mode for main branch
  # ============================================================
  test:
    name: Test
    runs-on: ubuntu-latest
    needs: [ format ]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ci-test
          cache-on-failure: true

      - name: Install system dependencies
        uses: awalsh128/cache-apt-pkgs-action@latest
        with:
          packages: libgtk-3-dev libxdo-dev
          version: 1.0

      - name: Run tests
        run: |
          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
            echo "Running release tests (main branch)"
            cargo test --all --release
          else
            echo "Running debug tests (PR/feature branch)"
            cargo test --all
          fi

  # ============================================================
  # Documentation Build
  # Ensures docs build without warnings
  # ============================================================
  docs:
    name: Documentation
    runs-on: ubuntu-latest
    needs: [ format ]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ci-docs
          cache-on-failure: true

      - name: Install system dependencies
        uses: awalsh128/cache-apt-pkgs-action@latest
        with:
          packages: libgtk-3-dev libxdo-dev
          version: 1.0

      - name: Build documentation
        env:
          RUSTDOCFLAGS: -D warnings
        run: cargo doc --no-deps --all-features

  # ============================================================
  # Security Audit
  # Checks for known vulnerabilities in dependencies
  # Only runs on main branch, PRs to main, and scheduled builds
  # ============================================================
  #  audit:
  #    name: Security Audit
  #    runs-on: ubuntu-latest
  #    if: github.event_name == 'schedule' || github.event_name == 'push' || github.event_name == 'workflow_dispatch'
  #    steps:
  #      - name: Checkout repository
  #        uses: actions/checkout@v6
  #
  #      - name: Install cargo-audit
  #        uses: taiki-e/install-action@v2
  #        with:
  #          tool: cargo-audit
  #
  #      - name: Run security audit
  #        run: cargo audit --deny warnings

  # ============================================================
  # Security Analysis (SARIF)
  # Uploads results to GitHub Security tab
  # Only runs on main branch and scheduled builds (not PRs)
  # ============================================================
  security-analysis:
    name: Security Analysis
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request'
    permissions:
      contents: read
      security-events: write
      actions: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ci-security
          cache-on-failure: true

      - name: Install system dependencies
        uses: awalsh128/cache-apt-pkgs-action@latest
        with:
          packages: libgtk-3-dev libxdo-dev
          version: 1.0

      - name: Install SARIF tools
        run: cargo install clippy-sarif sarif-fmt

      - name: Generate SARIF report
        run: |
          cargo clippy --all-targets --all-features --message-format=json \
            | clippy-sarif \
            | tee rust-clippy-results.sarif \
            | sarif-fmt
        continue-on-error: true

      - name: Upload to GitHub Security
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: rust-clippy-results.sarif
          wait-for-processing: true

  # ============================================================
  # Flatpak Manifest Validation
  # Validates manifest syntax and lints without full build
  # Lightweight check that runs on PRs and pushes to main
  # ============================================================
  #  flatpak-lint:
  #    name: Flatpak Lint
  #    runs-on: ubuntu-latest
  #    container:
  #      image: ghcr.io/flathub-infra/flatpak-github-actions:freedesktop-25.08
  #      options: --privileged
  #    steps:
  #      - name: Checkout repository
  #        uses: actions/checkout@v6
  #
  #      - name: Validate YAML syntax
  #        run: |
  #          python3 -c "import yaml; yaml.safe_load(open('assets/flatpak/io.github.rubentalstra.trial-submission-studio.yml'))"
  #          echo "Manifest YAML syntax is valid"
  #
  #      - name: Lint manifest
  #        run: |
  #          flatpak-builder-lint \
  #            --exceptions \
  #            --gha-format \
  #            manifest assets/flatpak/io.github.rubentalstra.trial-submission-studio.yml
  #
  #      - name: Lint appstream metadata
  #        run: |
  #          flatpak-builder-lint \
  #            --exceptions \
  #            --user-exceptions assets/flatpak/linter-exceptions.json \
  #            --gha-format \
  #            appstream assets/linux/io.github.rubentalstra.trial-submission-studio.metainfo.xml

  # ============================================================
  # CI Success Gate
  # All required checks must pass
  # clippy-extended is optional for PRs (only runs on main)
  # ============================================================
  ci-success:
    name: CI Success
    runs-on: ubuntu-latest
    needs: [ verify-versions, format, clippy, clippy-extended, test, docs ]
    if: always()
    steps:
      - name: Check all jobs passed
        run: |
          # Required jobs must pass
          if [[ "${{ needs.verify-versions.result }}" != "success" ]] ||
             [[ "${{ needs.format.result }}" != "success" ]] ||
             [[ "${{ needs.clippy.result }}" != "success" ]] ||
             [[ "${{ needs.test.result }}" != "success" ]] ||
             [[ "${{ needs.docs.result }}" != "success" ]]; then
            echo "One or more required jobs failed"
            exit 1
          fi
          # Extended clippy is optional for PRs (may be skipped)
          if [[ "${{ needs.clippy-extended.result }}" != "success" ]] &&
             [[ "${{ needs.clippy-extended.result }}" != "skipped" ]]; then
            echo "Extended clippy failed"
            exit 1
          fi
          echo "All required jobs passed!"